Canada’s Anti-Spam Legislation (CASL) is enforced by three federal agencies, the Canadian Radio-television and Telecommunications Commission (CRTC), the Office of the Privacy Commissioner of Canada (OPC) and the Competition Bureau. In late November 2020, they published a joint news release announcing they had issued letters to 36 businesses in the mobile app industry in Canada advising these businesses to review their practices relating to the promotion, installation and use of mobile apps and to take corrective actions where necessary. An example of the letter sets out a variety of practices that could potentially violate CASL, such as apps that:
- convey false or misleading representations;
- collect consumer information without adequately disclosing to consumers how their information will be used or shared;
- false or misleading representations regarding the handling of consumer information;
- collect or use electronic addresses in bulk, e.g., “harvesting” users’ contacts to sell/share with other parties without express user consent;
- are designed to send out unsolicited commercial electronic messages without consent;
- when installed, download a second program on a user’s computer or device without a user’s knowledge or consent; and
- generate malicious activity once installed (e.g., phishing messages, malware or other online threats).
The letter encouraged companies to take steps to revise their CASL-compliance practices, such as developing and implementing a written corporate compliance program and adopting agreements with app developers that mandate CASL compliance.
While the letters in this instance were sent to the mobile app industry, these agencies have been clear that all businesses must ensure their commercial activities do not jeopardize the online security of Canadians. The information in these letters is helpful for all organizations that collect consumer information and send promotional emails. Organizations should take this opportunity to review their internal compliance programs to ensure they are fulfilling their obligations under CASL.